I have a custom policy set to do a full system scan Saturdays at 0300.  The default policy does not call for a full scan.  This Monday morning all 1900 PCs in the target collection started a full scan at 1041.  Any ideas where to look as to why this started?

Hi,

If you look in the SChedule tasks on one of the affected clients you should see a Schedule task for the Full Scan on sunday's, could it be that the Schedule task will run directly if missed x number of times? you should see that in the Schedule.

Regards,
Jrgen

Hi,

I checked the task scheduler on a few different machines and I don't see anything set there to run it again after a set number of times.  Also I checked the history of the task scheduler and could see where the machines successfully intiated the scan on the scheduled time.

I have a theory that an administrator may have iniated a full scan on the collection instead of an individual machine.  Do anyone know what log file I would check to see if this happened?

Hi,

Thank you for the post.

Please check the history of the scheduled task to see if it was invoked externally. Could be it be the idle state and/or the power state (AC vs. Battery/DC) of the computer? Are there two schedules set (weekly and daily)?

Regards,

I've checked and it was not a scheduled task as there is nothing in the task scheduler for that date.  I believe it was mistakenly initiate by an adminitrator on a collection instead of an individual PC.  I have found under Monitoring - Client Operations when the Full Scan was initated and that you can cancel or delete the operation.